AI generated, spot checked on 1 November 2026: Provider OAuth rules and review policies change frequently. Always verify current submission requirements with the official Google (Sensitive & Restricted Scopes) documentation before submitting for production approval.

Google (Sensitive & Restricted Scopes)

HARDFrom official docs

Two clearly separate parts: Sensitive scopes (verification review, no security assessment, review can take up to about 10 days) and Restricted scopes (verification plus an annual assessment by a Google approved assessor, repeated at least every 12 months). Restricted scopes usually take several weeks in total (Estimate). Sensitive scopes: up to about 10 days (From official docs). Restricted scopes: several weeks plus assessor time (Estimate, not from Google).

console.cloud.google.comAI generated, spot checked on 1 November 2026

At a glance

Executive breakdown in plain language

Difficulty

HARD

Setup Time

2 - 4 hoursEstimate

Active engineering effort required to register the OAuth app, set redirect URLs, and obtain credentials.

Approval Wait

Sensitive scopes: up to about 10 days (From official docs). Restricted scopes: several weeks plus assessor time (Estimate, not from Google).

Biggest Blocker

Verification rejected due to homepage or privacy policy domain mismatch

Fix: Ensure the homepage is public and describes the app, and the privacy policy must be on the same domain as the homepage. Domain must be verified in Search Console by a project Owner or Editor.

Required Before Starting

• The homepage must be public and describe the app (From official docs)

• The privacy policy must be on the same domain as the homepage (From official docs)

• Each sensitive scope needs a written justification (From official docs)

• Domain verified in Search Console by a project Owner or Editor (From official docs)

• Unlisted YouTube demo video showing client ID visible in the address bar and demonstrating how the app uses requested scopes (From official docs)

• Annual assessment by a Google approved assessor, repeated at least every 12 months, for restricted scopes (From official docs)

• The name 'Tier 2' and assessor fees are reported by third parties, not on Google's pages. Check with the assessor. (Community reported)

• Google Cloud Platform (GCP) project with billing enabled (Could not confirm)

• 100 test user cap in OAuth consent screen testing mode before verification (Could not confirm)

Step-by-Step Setup Guide

6 steps

From official docs

Follow these sequential actions to register your OAuth application and configure endpoints.

Create a GCP Project & Enable APIs

Go to Google Cloud Console, create a new project, and enable the target APIs (such as Gmail API for full Gmail access) in the API Library.

Open in Google (Sensitive & Restricted Scopes) Console

Configure OAuth Consent Screen, Homepage & Privacy Policy

Select User Type 'External'. Enter App Name, Support Email, and Developer Email. The homepage must be public and describe the app, and the privacy policy must be on the same domain as the homepage.

Open in Google (Sensitive & Restricted Scopes) Console

Domain Verification in Search Console by Owner or Editor

Verify your domain ownership in Google Search Console. The domain must be verified by a user who is designated as an Owner or Editor on the Google Cloud project.

Open in Google (Sensitive & Restricted Scopes) Console

Record Unlisted YouTube Demo Video

Record an Unlisted YouTube demo video showing: 1) the OAuth grant consent screen with client ID visible in the address bar, and 2) how your app uses requested scopes in user interface features.

Open in Google (Sensitive & Restricted Scopes) Console

Submit Sensitive Scopes: Written Justifications

Part 1 (Sensitive scopes): Verification review, no security assessment, review can take up to about 10 days. Each sensitive scope needs a written justification explaining why non-sensitive scopes are inadequate.

Open in Google (Sensitive & Restricted Scopes) Console

Submit Restricted Scopes: Annual Assessment

Part 2 (Restricted scopes, such as full Gmail access): Verification plus an annual assessment by a Google approved assessor, repeated at least every 12 months. Restricted scopes usually take several weeks in total (Estimate). Sensitive scopes: up to about 10 days (From official docs). Restricted scopes: several weeks plus assessor time (Estimate, not from Google). The name 'Tier 2' and assessor fees are reported by third parties, not on Google's pages. Check with the assessor.

Open in Google (Sensitive & Restricted Scopes) Console

Common Blockers & Fixes

4 blockers

From official docs

Anticipate the pitfalls and approval rejections that catch most agent developers off guard.

Verification rejected due to homepage or privacy policy domain mismatch

Action Plan: Ensure the homepage is public and describes the app, and the privacy policy must be on the same domain as the homepage. Domain must be verified in Search Console by a project Owner or Editor.

Demo video rejected because client ID is not visible in address bar or video is not Unlisted

Action Plan: Re-record an Unlisted YouTube demo video ensuring the browser address bar clearly shows the full client_id query parameter during the OAuth redirect, and demonstrating how the app uses requested scopes.

Sensitive scope rejected for inadequate written justification

Action Plan: Each sensitive scope needs a written justification explaining user-facing necessity. Sensitive scopes: verification review, no security assessment, review can take up to about 10 days.

Restricted scopes requirement: annual assessment by a Google approved assessor, repeated at least every 12 months

Action Plan: Restricted scopes (such as full Gmail access) require all sensitive scope criteria plus an annual assessment by a Google approved assessor, repeated at least every 12 months. Restricted scopes usually take several weeks in total (Estimate). Sensitive scopes: up to about 10 days (From official docs). Restricted scopes: several weeks plus assessor time (Estimate, not from Google). The name 'Tier 2' and assessor fees are reported by third parties, not on Google's pages. Check with the assessor. Sensitive scopes: verification review, no security assessment, review can take up to about 10 days.

What an agent can do vs what you must do

Agent vs Developer

From official docs

A clear division of labor: tasks your autonomous agent can handle vs actions requiring human developer authorization.

What an Agent Can Do

Generate code for OAuth 2.0 PKCE flow, state parameter validation, and token refresh logic
Draft written justifications for each sensitive scope and privacy disclosure copy
Validate redirect URI formatting and client configuration

What You Must Do Yourself

Verify domain in Google Search Console as a GCP project Owner or Editor
Ensure homepage is public, describes the app, and hosts the privacy policy on the same domain
Record and upload an Unlisted YouTube demo video showing client ID visible in the address bar and scope usage
Complete an annual assessment by a Google approved assessor, repeated at least every 12 months, for restricted scopes (such as full Gmail access)

Managed OAuth vs Custom Credentials

From official docs

Evaluate whether using a managed integration platform (like Composio) is sufficient or if you must create your own app.

This tool was built for a Composio assignment, and Composio sells managed OAuth.

When Managed OAuth is Enough

Composio provides a pre-verified Google OAuth app (Composio's own claim, not independently checked) for building AI assistants or agent tools that need restricted scopes (such as full Gmail access) without waiting on an annual assessment by a Google approved assessor, repeated at least every 12 months. Sensitive scopes: up to about 10 days (From official docs). Restricted scopes: several weeks plus assessor time (Estimate, not from Google). This site was built for a Composio assignment, and Composio sells managed OAuth.

When Custom Credentials are Required

You must complete custom Google verification if your enterprise customers demand your specific brand name on the Google consent dialog, or if your enterprise security policy prohibits routing tokens through a third-party managed infrastructure.

Key Claims & Verification Status

Could not confirm

Specific factual statements evaluated against sources.

Sensitive scopes: verification review, no security assessment, review can take up to about 10 days.

Restricted scopes: verification plus an annual assessment by a Google approved assessor, repeated at least every 12 months. Restricted scopes usually take several weeks in total (Estimate).

Verified domain in Search Console by a project Owner or Editor, privacy policy on the same domain as a public homepage describing the app, Unlisted YouTube demo video showing the client ID in the address bar, and written justification for each sensitive scope.

Sensitive scopes: up to about 10 days (From official docs).

Restricted scopes: several weeks plus assessor time (Estimate, not from Google).

Unverified estimate

The name 'Tier 2' and assessor fees are reported by third parties, not on Google's pages. Check with the assessor.

Community reported

Google Cloud Platform (GCP) project with billing enabled and 100 test user cap in OAuth consent screen testing mode before verification.

Could not confirm

Composio provides a pre-verified Google OAuth app.

Composio's own claim, not independently checked

Official Sources & Documentation

2 sources

From official docs

Google Identity: Sensitive Scope Verification Google Identity: Restricted Scope Verification

Open Questions & Uncertainties

1 open questions

Unverified estimate

Areas currently subject to policy changes or requiring ongoing real-world verification.

Does Google offer fee subsidies or waivers for early-stage bootstrapped AI agent startups undertaking an annual assessment by a Google approved assessor, repeated at least every 12 months?